CVE-2014-5160

medium · 6.4

Multiple directory traversal vulnerabilities in crs.exe in the Cell Request Service in HP Data Protector allow remote attackers to create arbitrary files via an opcode-1091 request, or create or delete arbitrary files via an opcode-305 request. NOTE: the vendor reportedly asserts that this behavior is "by design.

6.4

CVSS

34.8%

EPSS (exploit prob.)

98th

EPSS percentile

2014-08-01

Published

AV:N/AC:L/Au:N/C:N/I:P/A:P

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
hp	data_protector	6.10
hp	data_protector	6.11

Check a specific version with /api/v1/cve/match.

References

http://zerodayinitiative.com/advisories/ZDI-14-262/
http://zerodayinitiative.com/advisories/ZDI-14-263/
http://zerodayinitiative.com/advisories/ZDI-14-262/
http://zerodayinitiative.com/advisories/ZDI-14-263/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-5160